Windows 7 SP1 Convenience Rollup

[Arthur]

a.k.a. the next best thing to SP2.

 

Download (Direct Links: x64, x86) / KB Article

 

Simplifying updates for Windows 7 and 8.1

While we’ve spent a lot of time over the past year talking about Windows 10 (including new roadmap details), we know that organizations are still working with Windows 7 too, regularly updating their Windows 7 SP1 images to include the latest updates, app versions, and more. For those that are involved in that process, you’ve probably seen a display like this too many times:

 

 

New Windows 7 SP1 convenience rollup makes image creation much faster

We’re happy to announce today that we’re making available a new convenience rollup for Windows 7 SP1 that will help. This convenience rollup package, available to download from http://catalog.update.microsoft.com/v7/site/Search.aspx?q=3125574, contains all the security and non-security fixes released since the release of Windows 7 SP1 that are suitable for general distribution, up through April 2016. Install this one update, and then you only need new updates released after April 2016.

 

And since this update can be injected into Windows 7 SP1 media, it’s fully supported to mount a Windows 7 SP1 image (WIM file), then inject this update into it. See https://technet.microsoft.com/en-us/library/dd744559(v=ws.10).aspx for the details of how to do this.

 

This convenience update is completely optional; it doesn’t have to be installed and won’t even be offered via Windows Update – you can choose whether or not you want to use it.

 

We hope that you find this convenience rollup package useful. This same convenience rollup also applies to Windows Server 2008 R2.

 

Monthly Rollups

Also today we are announcing that non-security updates for Windows 7 SP1 and Windows 8.1 (as well as Windows Server 2008 R2 SP1, Windows Server 2012 and Windows Server 2012 R2) will be available as a monthly rollup (fixes rolled up together into a single update). Each month, we will release a single update containing all of the non-security fixes for that month. We are making this change – shifting to rollup updates, to improve the reliability and quality of our updates.

 

These fixes will be available through Windows Update, WSUS, and SCCM as well as the Microsoft Update catalog. We hope this monthly rollup update simplifies your process of keeping Windows 7, and 8.1 up-to-date.

 

Simplifying finding and downloading updates

Updates have historically been published on the Microsoft Download Center and the Microsoft Update Catalog. Security Bulletins have linked directly to update packages on the Microsoft Download Center. To simplify this, within the next few months Windows updates will no longer be available from the Microsoft Download Center. Security bulletins will continue to link directly to the updates, but will point to the packages on the Microsoft Update Catalog instead of the Microsoft Download Center. Customers that use tools linking to the Microsoft Download Center should follow the links provided in the Security Bulletins or search directly on the Microsoft Update Catalog.

 

For those who aren’t familiar with the Microsoft Update Catalog website, note that it still requires using Internet Explorer at this point because of an ActiveX control used. Later this summer, we will be updating the site to eliminate the ActiveX control in order to support other browsers.

 

As always, all updates will still be available via WSUS, SCCM, and Windows Update – this change is only for manual downloads.

 

Source: https://blogs.technet.microsoft.com/windowsitpro/2016/05/17/simplifying-updates-for-windows-7-and-8-1

 

From the KB3125574 article...

 

We intentionally did not include any specific post-Service Pack 1 updates in convenience rollup 3125574 for which the following conditions are true:

 

• They don’t have broad applicability.
  
• They introduce behavior changes.
  
• They require additional user actions, such as making registry settings.
  

You may download and install such fixes manually after you determine whether they apply to your deployment scenarios. Specifically, the following fixes are not included in this convenience rollup:

 

2620264 - You cannot start any RemoteApp applications through a Windows Server 2008-based or later Terminal Server or RD Gateway

2646060 - An update that selectively disables the Core Parking feature in Windows 7 or in Windows Server 2008 R2 is available

2647954 - The PIN dialog box does not appear or you are presented with all the certificates in the store when you try to access a WebDAV server in Windows 7 or in Windows Server 2008 R2

2663685 - Changes that are not replicated to a downstream server are lost on the upstream server after an automatic recovery process occurs in a DFS Replication environment in Windows Server 2008 R2

2695321 - IPsec session takes 5 to 6 minutes to connect to a storage controller on a computer that is running Windows Vista, Windows Server 2008, Windows 7, or Windows Server 2008 R2

2727994 - You cannot open or save Office 2010 documents on a WebDAV file server on a computer that is running Windows 7 or Windows Server 2008 R2

2728738 - You experience a long logon time when you try to log on to a Windows 7-based or a Windows Server 2008 R2-based client computer that uses roaming profiles

2750841 - An IPv6 readiness update is available for Windows 7 and for Windows Server 2008 R2

2752259 - An update that improves the performance of the Printbrm.exe command-line tool in Windows 7 or in Windows Server 2008 R2 is available

2891144 - Application does not draw polylines correctly when you run it through an RD Session in Windows Server 2008 R2 SP1

2898851 - Description of the security update for the .NET Framework 3.5.1 on Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: May 13, 2014

2907020 - "Location is not available" error when you access a mapped network drive after Windows standby or resume

2918833 - Third-party IMEs give users unprotected access to your Windows 7-based or Windows Server 2008 R2-based system

2923766 - Black screen when you plug in a monitor on a computer or open a lid of a laptop that is running in Windows

2925489 - You cannot establish an IPsec connection with certain third-party devices in Windows

2990184 - A FIPS-compliant recovery password cannot be saved to AD DS for BitLocker in Windows 7 or Windows Server 2008 R2

2781512 - WinRM operations to Hyper-V fail on a Windows 7 SP1-based or Windows Server 2008 R2 SP1-based computer that has Windows Management Framework 3.0 installed

2823180 - Update is available for Windows Management Framework 3.0 in Windows 7 SP1, Windows Server 2008 R2 SP1, or Windows Server 2008 SP2

2802886 - You cannot register an SPN from a Windows 7, Windows 8, Windows Server 2008 R2 or Windows Server 2012-based client computer in a disjoint namespace

2842230 - "Out of memory" error on a computer that has a customized MaxMemoryPerShellMB quota set and has WMF 3.0 installed

2887064 - The Start-Process cmdlet ignores the "-Wait" parameter when the cmdlet is started remotely on a Windows 7 SP1, Windows Server 2008 R2 SP1, Windows Vista SP2, or Windows Server 2008 SP2 computer that has Windows Management Framework 3.0 installed

2889748 - High memory usage by the Svchost.exe process after you install Windows Management Framework 3.0 on a Windows-based computer

2830615 - $MyInvocation.MyCommand object is set to null when you run the script by using PowerShell 3.0 in Windows 8 or in Windows Server 2012

 

This convenience rollup also does not include any of the servicing updates for Internet Explorer. If you require the servicing updates for Internet Explorer, download and install the latest Security update for Internet Explorer.

Edited May 17, 2016 by Arthur

[psydii]

Excellent.

 

But quite grumpy about this. Seriously Arthur, how do you manage to get the scoop on these things *minutes* before me, every single time?

 

 

UPDATE:

Looking at it quickly, they've excluded 2728738 which contains a SBSL fix. While later (included) hotfixes update all the components that 2728738 updates, 2728738 included a registry update that enable the SBSL fix. I think they've got their thinking backwards by excluding it.

 

A similar issue around 2647954.

 

My advice to all is to install 2775511 + the three recommended hotfixes from that KB Article, and then install this one, and if any of the excluded hotfixes contain updates of subsystems in use in your environment, install those too.

Edited May 17, 2016 by psydii

[Arthur]

how do you manage to get the scoop on these things *minutes* before me, every single time?

I have a time machine!!!

 

Actually, I follow Mary Jo Foley on Twitter and she posted a link to an article on ZDNet about the update...

 

www.zdnet.com/article/microsoft-comes-through-with-rollup-of-updates-and-fixes-for-windows-7

 

The new Windows 7 convenience rollup is cumulative back to Service Pack 1, which Microsoft released in 2011. It doesn't include updates to IE 11 (which are released separately) or updates to .NET releases. But it does include core Windows fixes, security fixes and hotfixes.

^ It's a shame the rollup doesn't include IE or .NET Framework updates, but I suppose this is better than nothing.

 

I think they've got their thinking backwards by excluding it.

Microsoft never make it easy!

Edited May 17, 2016 by Arthur

[DJ-1701]

Seriously Arthur, how do you manage to get the scoop on these things *minutes* before me, every single time?

 

I have a time machine!!!

 

I KNEW IT!

[Arthur]

My advice to all is to install 2775511 + the three recommended hotfixes from that KB article, and then install this one, and if any of the excluded hotfixes contain updates of subsystems in use in your environment, install those too.

Here are the direct links to those updates...

 

KB2775511 - An enterprise hotfix rollup is available for Windows 7 SP1 and Windows Server 2008 R2 SP1

[b]KB2732673[/b] - [i]"Delayed write failed" error message when .pst files are stored on a network file server that is running Windows Server 2008 R2[/i]
[b]x64[/b]: http://download.windowsupdate.com/c/msdownload/update/software/htfx/2013/11/windows6.1-kb2732673-v4-x64_801bb11beb007464927d0988992005f63899dab2.msu
[b]x86[/b]: http://download.windowsupdate.com/c/msdownload/update/software/htfx/2013/11/windows6.1-kb2732673-v4-x86_259e505f27ff6feadd21da21ba52e2d4682741ae.msu

[b]KB2728738[/b] - [i]You experience a long logon time when you try to log on to a Windows 7-based or a Windows Server 2008 R2-based client computer that uses roaming profiles[/i]
[b]x64[/b]: http://download.windowsupdate.com/c/msdownload/update/software/htfx/2013/11/windows6.1-kb2728738-v3-x64_22e4457734ff8c995a3637f95ea7848de7956a0d.msu
[b]x86[/b]: http://download.windowsupdate.com/c/msdownload/update/software/htfx/2013/11/windows6.1-kb2728738-v3-x86_ab45e3a08d2ccf2d7049230be68d46f8bce20170.msu

[b]KB2878378[/b] - [i]OpsMgr 2012 or OpsMgr 2007 R2 generates a "Heartbeat Failure" message and then goes into a greyed out state in Windows Server 2008 R2 SP1[/i]
[b]x64[/b]: http://download.windowsupdate.com/d/msdownload/update/software/htfx/2013/12/windows6.1-kb2878378-v2-x64_eb7f7ae83a8d77ba88b228e058fc9c152c211e7a.msu
[b]x86[/b]: http://download.windowsupdate.com/d/msdownload/update/software/htfx/2013/12/windows6.1-kb2878378-v2-x86_06e4de0fece85661cdd00f7fe176401511985ac4.msu

 

KB3020369 - April 2015 servicing stack update for Windows 7 and Windows Server 2008 R2 (prerequisite for the Convenience Rollup)

[b]x64[/b]: http://download.windowsupdate.com/d/msdownload/update/software/updt/2015/04/windows6.1-kb3020369-x64_5393066469758e619f21731fc31ff2d109595445.msu
[b]x86[/b]: http://download.windowsupdate.com/d/msdownload/update/software/updt/2015/04/windows6.1-kb3020369-x86_82e168117c23f7c479a97ee96c82af788d07452e.msu

 

KB3125574 - Windows 7 SP1 Convenience Rollup

[b]x64[/b]: http://download.windowsupdate.com/d/msdownload/update/software/updt/2016/05/windows6.1-kb3125574-v4-x64_2dafb1d203c8964239af3048b5dd4b1264cd93b9.msu
[b]x86[/b]: http://download.windowsupdate.com/d/msdownload/update/software/updt/2016/05/windows6.1-kb3125574-v4-x86_ba1ff5537312561795cc04db0b02fbb0a74b2cbd.msu

 

KB2647954 - The PIN dialog box does not appear or you are presented with all the certificates in the store when you try to access a WebDAV server in Windows 7 or in Windows Server 2008 R2

https://support.microsoft.com/en-gb/kb/2647954 (Download link 404s for me for some reason?)

Edited May 17, 2016 by Arthur

[mrwoberts]

LOL, I've just spent the best part of a few days solid work perfecting a from scratch integration...install

 

At least this has the potential to speed that process up from now on

 

Thanks Arthur, or should we call you .... Doc Brown?

 

EDIT: Not so fast Mr Microsoft.... Just tried integrating your 'rollup' into an untouched SP1 iso and it fails after 33% ??

I'm not giving up on my hours of work without a fight, you pesky rollup!!

Edited May 17, 2016 by mrwoberts

[Arthur]

Just tried integrating your 'rollup' into an untouched SP1 iso and it fails after 33%?

I have just done the same with the .wim from an untouched 64-bit Windows 7 SP1 Enterprise ISO and it worked for me. It took 15 minutes in total.

 

Edit. It didn't work.

 

Thanks Arthur, or should we call you .... Doc Brown?

After the day I have had today I feel more like Tom Cruise in Edge of Tomorrow.

Edited May 17, 2016 by Arthur

[mrwoberts]

I have just done the same with the .wim from an untouched Windows 7 SP1 Enterprise ISO and it worked for me. It took 15 minutes in total.

 

Interesting. I was using a 64bit Pro iso. What OS were you running the integration from? I have attempted other 7 Pro .wim integrations on my 10x64 Pro Host but it kept failing, so I installed the base 7 iso in a VirtualBox instance and integrated from that - this worked fine for my previous few days work, so I tried the same with this update package and Boom! Computer says No.

 

Hope you have a better day tomorrow mate.

[Arthur]

I spoke too soon. I didn't see it at first, but I scrolled back up in my PowerShell window and noticed the following error message.

 

WARNING: Add-WindowsPackage failed. Error code = 0x800736b5
WARNING: An error occurred applying the Unattend.xml file from the .msu package.

 

Not that it should make any difference but I was using the Mount-WindowsImage, Add-WindowsPackage, Dismount-WindowsImage cmdlets to do the integration, rather than DISM directly.

 

What OS were you running the integration from?

Windows 10 Pro (x64) - Build 10586.318.

Edited May 17, 2016 by Arthur

[Arthur]

@mrwoberts. The prerequisites section of KB3125574 mentions this...

 

To apply this update, you must install Service Pack 1 for Windows 7 or Windows Server 2008 R2 (KB976932) and April 2015 servicing stack update for Windows 7 and Windows Server 2008 R2 (KB3020369).

 

You also need at least 4 GB of free disk space to install this update. After a brand-new installation, the disk usage will increase by between 1 GB and 2 GB, depending on processor type (x86 vs. x64) and edition (Enterprise or ThinPC).

 

I should have RTFM!

[mrwoberts]

Well spotted, thanks for that.

 

I'm using the old fashioned DISM, and unpacking the .msu to integrate the .cab; would you recommend a change in method, as I'd much rather do the work in my host OS - same as you.

By the way, how do you discover the extra build version of Windows 10. Mine says Build 10586 but I don't see .318

 

Interested in your PowerShell method.

 

Many thanks Arthur

Edited May 18, 2016 by mrwoberts

[Arthur]

I'm using the old fashioned DISM, and unpacking the .msu to integrate the .cab; would you recommend a change in method, as I'd much rather do the work in my host OS - same as you.

I would carry on using DISM.

 

By the way, how do you discover the extra build version of Windows 10. Mine says Build 10586 but I don't see .318

Windows key, type winver, press Enter (or here).

 

Interested in your PowerShell method

I'll have to post the script I am using once I have tested it a bit more.

 

This time the integration took 25 minutes and there weren't any errors.

[Jawloms]

Does it include any updates which then offer a Windows 10 upgrade?

[mats]

Does it include any updates which then offer a Windows 10 upgrade?

 

Slashdot says yes.

 

https://tech.slashdot.org/story/16/05/17/1941210/microsoft-releases-big-convenience-rollup-update-for-windows-7?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

[Arthur]

Does it include any updates which then offer a Windows 10 upgrade?

Telemetry = yes, GWX = no.

 

I assume you have already blocked Windows 10 upgrades through Group Policy?

[mrwoberts]

@Arthur

 

Could you point me in the right direction to integrate this rollup.

Here's what I've just tried, and the error I received.

 

Two updates inside the folder d:\updates

 

Windows6.1-KB3020369-x64.cab

Windows6.1-KB3125574-v4-x64.cab

 

Mount the .wim (from untouched 7x64 Pro SP1 iso)

 

DISM  /Mount-Wim  /Wimfile:"install.wim"  /index:1  /MountDir:"d:\offline"
[i]Once mounted, I then issue the command...[/i]

DISM  /image:"d:\offline"  /add-package   /packagepath:d:\updates\

Deployment Image Servicing and Management tool
Version: 10.0.10586.0

Image Version: 6.1.7600.16385

Processing 1 of 2 - Adding package Package_for_KB3020369~31bf3856ad364e35~amd64~~6.1.1.1
[==========================100.0%==========================]
Processing 2 of 2 - Adding package Package_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4
[===================        33.3%                          ]

Error: 14005

Package Package_for_KB3125574 may have failed due pending updates to servicing components in the image. Try the command again.The command completed with errors.
For more information, refer to the log file.

 

What am I doing wrong?

[Arthur]

Once mounted, I then issue the command...

If you run DISM /Get-MountedWiminfo is the Status showing as "Invalid"? If so, run DISM /Cleanup-Wim, then with an untouched install.wim from your ISO...

 

DISM /Mount-Wim /Wimfile:"d:\install.wim" /Index:1 /MountDir:"d:\offline"
DISM /Image:"d:\offline" /Add-Package /PackagePath:d:\updates\Windows6.1-KB3020369-x64.cab
DISM /Image:"d:\offline" /Add-Package /PackagePath:d:\updates\Windows6.1-KB3125574-v4-x64.cab
DISM /Unmount-Wim /MountDir:"d:\offline" /Commit

 

Edit. I remember reading somewhere that you have to add the updates in separate steps. I have amended the script above. Does this work?

Edited May 18, 2016 by Arthur

[mrwoberts]

Flamin' Koalas! You're absolutely right Arthur, they've got to be issued with separate DISM commands.

 

I'm just adding IE 11 aswell and then I'll install into a VM to see if there are any missing updates.

 

Thanks again buddy.

 

By the way, with this update, what other updates do you inject...

 

Using your info above, I wondered if this would be a complete enough list..

 

First

KB3020369

-------------

Next

KB3125574

-------------

Then

KB2670838 (needed to allow IE11)

IE11-KB2841134

IE11-KB3154070

-------------

Finally

KB2728738

KB2732673

KB2878378

 

 

EDIT: Added KB2670838 to allow IE11 integration

Edited May 18, 2016 by mrwoberts

[mrwoberts]

Scratch that last post, reading the posts (again, clearly) from you and psydii above, my new integrate command is thus...

 

DISM   /image:d:\offline  /add-package  /packagepath:d:\updates\Windows6.1-KB2775511-v2-x64.cab
DISM   /image:d:\offline  /add-package  /packagepath:d:\updates\Windows6.1-KB2732673-v4-x64.cab
DISM   /image:d:\offline  /add-package  /packagepath:d:\updates\Windows6.1-KB2728738-v3-x64.cab
DISM   /image:d:\offline  /add-package  /packagepath:d:\updates\Windows6.1-KB2878378-v2-x64.cab

DISM   /image:d:\offline  /add-package  /packagepath:d:\updates\Windows6.1-KB3020369-x64.cab

DISM   /image:d:\offline  /add-package  /packagepath:d:\updates\Windows6.1-KB3125574-v4-x64.cab

DISM   /image:d:\offline  /add-package  /packagepath:d:\updates\Windows6.1-KB2670838-x64.cab
DISM   /image:d:\offline  /add-package  /packagepath:d:\updates\Windows6.1-KB2841134-x64.cab
DISM   /image:d:\offline  /add-package  /packagepath:d:\updates\Windows6.1-KB3154070-x64.cab

[Arthur]

Scratch that last post, reading the posts (again, clearly) from you and psydii above, my new integrate command is thus...

That looks fine, although I would do KB3020369 first since that's a servicing stack update.

 

The servicing stack includes the files and resources that are required to service a Windows image. This includes the Package Manager executable, the required servicing libraries, and other resources. The servicing stack is included in all Windows installations.

[Arthur]

For reference, here's a list of all of the updates included in the Convenience Rollup...

 

KB2574819
KB2603229
KB2607047
KB2607576
KB2633952
KB2639308
KB2640148
KB2647753
KB2660075
KB2661254
KB2677070
KB2679255
KB2699779
KB2709630
KB2709981
KB2719857
KB2726535
KB2731771
KB2732059
KB2732487
KB2732500
KB2735855
KB2739159
KB2741355
KB2749655
KB2756822
KB2760730
KB2762895
KB2763523
KB2773072
KB2779562
KB2786081
KB2786400
KB2791765
KB2794119
KB2798162
KB2799926
KB2800095
KB2808679
KB2813956
KB2829104
KB2830477
KB2834140
KB2835174
KB2836502
KB2843630
KB2846960
KB2846960
KB2847077
KB2852386
KB2853952
KB2863058
KB2868116
KB2882822
KB2888049
KB2890882
KB2891804
KB2893519
KB2904266
KB2905454
KB2908783
KB2913152
KB2913431
KB2913751
KB2918077
KB2919469
KB2922717
KB2923398
KB2923545
KB2928562
KB2929733
KB2929755
KB2966583
KB2970228
KB2973337
KB2977728
KB2978092
KB2980245
KB2981580
KB2985461
KB2994023
KB2998527
KB2999226
KB3000988
KB3001554
KB3004394
KB3005788
KB3006121
KB3006137
KB3006625
KB3008627
KB3009736
KB3013410
KB3013531
KB3014406
KB3020338
KB3020370
KB3040272
KB3045645
KB3048761
KB3049874
KB3054476
KB3065979
KB3068708
KB3075249
KB3077715
KB3078667
KB3080079
KB3080149
KB3081954
KB3092627
KB3095649
KB3102429
KB3107998
KB3112148
KB3118401
KB3121255
KB3133977
KB3137061
KB3138378
KB3138901
KB3147071
KB3148851

[mrwoberts]

After I'd integrated I installed into a VM, which seemed to go smoothly. However, when I Checked for updates it took an age.... 100% CPU svchost... In fact, I shut it down as I couldn't wait any longer.

I was reading around and some people are saying that with an offline integration of this rollup, SFC /SCANNOW detects damaged components post install.

If you had a chance to run SFC on your fresh install, that would be interesting to compare.

 

I'll be doing lots more testing by the sounds of it, but I need to have a working solution ready for the summer, so I might just go back to what I'd done before the rollup came along.

 

Thanks for your help with this.

[Arthur]

I was reading around and some people are saying that with an offline integration of this rollup, SFC /SCANNOW detects damaged components post install.

Do you know if they integrated KB3020369 as the very first update?

 

If you had a chance to run SFC on your fresh install, that would be interesting to compare.

I'll give that a try and report back.

Edited May 19, 2016 by Arthur

[Arthur]

when I checked for updates it took an age.... 100% CPU svchost... In fact, I shut it down as I couldn't wait any longer.

The fix for that issue is to integrate KB3145739 and KB3153199. WU is massively faster after I added those two updates.

 

If you had a chance to run SFC on your fresh install, that would be interesting to compare.

I get corrupt files too, although SFC repaired them successfully.

 

 

This is the order I integrated my updates...

 

1. KB3020369 - Servicing Stack
   
2. KB2670838 - Platform Update
   
3. KB3125574 - Convenience Rollup
   
4. KB2841134 - IE11
   
5. KB3154070 - IE11 Cumulative Update (Latest)
   
6. KB3145739 & KB3153199 - Windows Update fixes
   
7. Everything else (e.g. KB2728738, KB2732673, KB2878378 etc.)
   

 

Time to do some more testing!

[mrwoberts]

LOL. This rollup is getting less convenient by the day.

But still, it seems a lot better than the 400+ updates and 2 hours it used to take me to get to this point.

 

Thanks for working on this Arthur. Got myself one of those busy days today so I'll take another look tomorrow.

 

To be continued ...